The Landrun project has begun development of a new system for isolated execution of individual applications. For isolation, the LSM module of the Linux kernel Landlock is used, which allows avoiding privileged operations during the creation of a sandbox environment. In terms of its tasks, Landrun is similar to the Firejail utility, but differs in its simpler implementation, lightweight nature, and the ability to run under a regular non-privileged user without being supplied with the suid flag. The project code is written in Go and is distributed under the GPLv2 license.
The Landlock mechanism allows unprivileged programs to restrict the use of Linux kernel objects, such as file hierarchies, network sockets, and ioctl. Unlike namespaces and system call filtering, the isolated environment is formed by the Linux kernel as an additional layer over existing access control mechanisms. To interact with the Landlock subsystem, the landrun utility uses the go-landlock library developed by the LandLock team.
Landrun helps reduce the risk of compromising the main system when running untrusted or potentially vulnerable programs. Notable features include support for selective access restrictions at the level of individual directories, binding privileges to file paths (allowing or denying reading, writing, and execution), and control over the initiation and reception of TCP connections.
For example, with Landrun, a process can be prohibited from executing files, allowed to write only to a specific subdirectory with data, prevented from creating listening sockets to accept network connections, and allowed to send network requests only to specified TCP ports. In the simplest case, to restrict writing, execution, and networking capabilities, the command "landrun —ro /" can be used, while for isolating nginx, the following command can be used: landrun —rox /usr/bin —ro /lib,/lib64,/var/www —rwx /var/log —bind-tcp 80,443 /usr/bin/nginx.
Future plans mention advanced access control to the file system, support for UDP, and process resource management. To restrict access at the file system level, at least Linux kernel 5.13 is required, and for network restrictions, 6.8.
Additionally, it is worth noting that changes have already been accepted into the Firejail codebase, allowing the use of the Landlock kernel subsystem for isolation without a suid bit and privilege escalation. However, the release with this support has not yet been published.
Source: opennet.ru
